Bug 857283 (CVE-2012-4425)

Summary:	CVE-2012-4425 spice-gtk/glib: Possible privilege escalation via un-sanitized environment variable
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	berrange, cfergeau, hdegoede, jlieskov, kem, marcandre.lureau, mclasen, virt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-19 21:57:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	854819, 854822, 854823, 854825, 857227, 857228
Bug Blocks:	847403

Description Huzaifa S. Sidhpurwala 2012-09-14 02:44:06 UTC

It was discovered that the spice-gtk setuid helper application, spice-client-glib-usb-acl-helper, did not clear the environment variables read by the libraries it uses. A local attacker could possibly use this flaw to escalate their privileges by setting specific environment variables before running the helper application. 

This flaw is similar to  CVE-2012-3524

Comment 2 Huzaifa S. Sidhpurwala 2012-09-14 02:54:44 UTC

Created spice-gtk tracking bugs for this issue

Affects: fedora-all [bug 857228]

Comment 3 Huzaifa S. Sidhpurwala 2012-09-14 02:58:56 UTC

Acknowledgement:

Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for
reporting this issue.

Comment 4 Huzaifa S. Sidhpurwala 2012-09-14 03:01:01 UTC

Reference:

http://seclists.org/oss-sec/2012/q3/470

Comment 6 Huzaifa S. Sidhpurwala 2012-09-14 03:23:32 UTC

Created glib2 tracking bugs for this issue

Affects: fedora-all [bug 857227]

Comment 7 errata-xmlrpc 2012-09-17 16:54:06 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1284 https://rhn.redhat.com/errata/RHSA-2012-1284.html

Comment 8 Jan Lieskovsky 2012-09-30 13:04:20 UTC

Upstream patch:
http://cgit.freedesktop.org/spice/spice-gtk/commit/?id=efbf867bb88845d5edf839550b54494b1bb752b9